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Mobile  ad  hoc  and  sensor  networks  may  consist  of  a  mixture  of  nodes,  some  of  which  may 
be  considered  selfish  due  to  a  lack  of  cooperativeness  in  providing  network  services  such  as 
forwarding  packets.  In  the  literature,  existing  trust  management  protocols  for  mobile  ad 
hoc  networks  advocate  isolating  selfish  nodes  as  soon  as  they  are  detected.  Further,  altru¬ 
istic  behaviors  are  encouraged  with  incentive  mechanisms.  In  this  paper,  we  propose  and 
analyze  a  trust  management  protocol  for  group  communication  systems  where  selfish 
nodes  exist  and  system  survivability  is  highly  critical  to  mission  execution.  Rather  than 
always  encouraging  altruistic  behaviors,  we  consider  the  tradeoff  between  a  node’s  indi¬ 
vidual  welfare  (e.g.,  saving  energy  to  prolong  the  node  lifetime)  vs.  global  welfare  (e.g., 
achieving  a  given  mission  with  sufficient  service  availability)  and  identify  the  best  design 
condition  of  this  behavior  model  to  balance  selfish  vs.  altruistic  behaviors.  With  the  system 
lifetime  and  the  mission  success  probability  as  our  trust-based  reliability  metric,  we  show 
that  our  behavior  model  that  exploits  the  tradeoff  between  selfishness  vs.  altruism  outper¬ 
forms  one  that  only  encourages  altruistic  behaviors. 

Published  by  Elsevier  B.V. 


1.  Introduction 

Most  existing  works  on  trust  management  in  mobile  ad 
hoc  networks  (MANETs)  in  the  presence  of  selfish  nodes 
encourage  cooperative  behaviors  while  discouraging  self¬ 
ish  behaviors  of  participating  nodes,  so  as  to  achieve  a  sys¬ 
tem  goal  such  as  high  service  availability.  A  common 
solution  is  to  isolate  selfish  nodes  as  soon  as  they  are  de¬ 
tected  and  to  reward  altruistic  nodes  with  incentive  mech¬ 
anisms  to  encourage  cooperation.  Many  MANET 
applications  such  as  disaster  management,  rescue  mis¬ 
sions,  and  military  tactical  operations  often  require  mul¬ 
ti-hop  communications  (e.g.,  multicast  or  broadcast) 
without  the  presence  of  a  trusted  infrastructure  in  an  envi¬ 
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ronment  where  resources  (e.g.,  bandwidth,  memory,  com¬ 
putational  power,  and  energy)  are  severely  constrained.  In 
such  applications,  encouraging  only  altruistic  behaviors 
may  lead  to  a  short  system  lifetime  span.  This  is  because 
altruistic  nodes  may  die  quickly  due  to  energy  depletion, 
thus  possibly  causing  a  system  failure  as  there  are  not  en¬ 
ough  nodes  remaining  in  the  system  to  continue  service. 
This  is  especially  detrimental  to  systems  designed  to  pro¬ 
long  the  system  lifetime  for  successful  mission  execution. 

Thomas  et  al.  [1]  studied  system  performance  in  this 
scenario,  and  claimed  that  there  must  be  a  tradeoff  be¬ 
tween  energy  saved  by  selfish  nodes  and  service  availabil¬ 
ity  provided  by  cooperative  nodes.  However,  no  analysis  of 
the  tradeoff  was  given.  Papadimitriou  [2]  described  these 
two  conflicting  goals  (i.e.,  the  local  goal  of  a  selfish  node 
to  save  its  energy  vs.  the  global  goal  of  an  altruistic  node 
to  provide  high  service  availability)  with  the  term  “the 
price  of  anarchy.”  The  price  of  anarchy  was  defined  as 
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the  performance  difference  between  a  system  run  by  an 
all-knowing  benign  dictator  who  can  make  right  decisions 
to  optimize  system  performance  vs.  a  system  run  by  a  self¬ 
ish  anarchy. 

We  advocate  that,  as  in  other  engineering  fields,  there 
should  be  a  tradeoff  between  system  survivability  and  ser¬ 
vice  availability  in  terms  of  these  two  conflicting  goals.  As 
Thomas  et  al.  [1]  indicated,  each  node  can  cognitively 
make  a  decision  for  its  own  interest  as  well  as  for  global 
interest  such  as  system  goals.  In  this  paper,  we  address  this 
problem  by  proposing  and  analyzing  a  behavior  model  that 
exploits  the  tradeoff  between  selfishness  vs.  altruism  for 
system  survivability  for  a  cognitive  mission-driven  group 
communication  system  (GCS)  in  MANETs  based  on  the 
concept  of  cognitive  networks.  Each  node  has  intelligence 
to  adapt  to  dynamically  changing  MANET  environments 
through  a  learning  process,  thereby  adjusting  its  altruistic 
vs.  selfish  behaviors  in  response  to  future  dynamics.  We 
seek  to  identify  the  optimal  design  settings  that  maximize 
the  system  lifetime  and  consequently  the  mission  success 
probability  while  satisfying  performance  requirements 
such  as  service  availability. 

We  adopt  the  demand  and  pricing  (DP)  mechanism 
originally  derived  from  economics  [3]  by  which  a  node  de¬ 
cides  whether  it  should  behave  selfishly  or  altruistically 
based  on  the  balance  between  individual  welfare  (i.e.,  sav¬ 
ing  energy)  and  global  welfare  (i.e.,  providing  services).  A 
node’s  decision  may  depend  on  its  own  energy  level,  1- 
hop  neighbors’  selfishness  levels  (i.e.,  to  judge  whether 
the  system  still  has  sufficient  resources  even  if  the  node 
is  selfish),  and  the  degree  of  mission  importance  (i.e.,  to 
judge  whether  a  node’s  selfish  behavior  would  have  a  sig¬ 
nificant  detrimental  impact  on  mission  success).  In  the  lit¬ 
erature,  social  scientists  have  addressed  the  tradeoff 
between  local/individual  utility  and  global/collective  inter¬ 
est  in  the  area  of  collaboration  theory  using  the  trust  con¬ 
cept  in  groups,  teams,  and  organizations  [4].  However,  no 
prior  work  exists  to  address  this  tradeoff  in  the  context 
of  networking  environments. 

Many  routing  protocols  for  MANETs  have  been  devel¬ 
oped  to  isolate  selfish  nodes  and  to  encourage  collabora¬ 
tion  among  participating  nodes  [5-12].  Das  et  al.  [5] 
proposed  a  new  credit-based  system  for  MANETs  where 
each  node  has  a  unique  IP  address.  Djenouri  et  al.  [6]  dem¬ 
onstrated  an  optimization  mechanism  to  improve  quality- 
of-service  (QoS)  by  alleviating  the  effect  of  selfish  nodes. 
Kargl  et  al.  [7]  developed  a  mechanism  to  detect  selfish 
nodes.  Wang  et  al.  [8]  devised  an  efficient  incentive  mech¬ 
anism  to  encourage  cooperative  behaviors.  Zhao  [9]  and 
Yan  and  Hailes  [10]  proposed  game  theoretic  approaches 
to  encourage  cooperativeness.  Miranda  and  Rodrigues 

[11]  proposed  an  algorithm  to  discourage  selfish  behaviors 
based  on  a  fair  distribution  of  resource  consumption.  Dif¬ 
ferent  from  the  above  work  [5-11],  Zhang  and  Agrawal 

[12]  reversed  the  common  intuition  about  selfish  nodes; 
they  found  the  positive  aspect  of  having  selfish  nodes  in 
terms  of  traffic  reduction,  and  identified  the  optimal  num¬ 
ber  of  selfish  nodes.  Except  [12],  all  prior  works  above 
emphasize  the  disadvantages  of  having  selfish  nodes  in 
MANETs.  Our  work  in  this  paper  is  different  from  all  above 
works  [5-12]  in  that  we  investigate  and  identify  the  best 


balance  between  individual  benefit  via  selfish  behaviors 
vs.  global  interest  via  altruistic  behaviors  so  as  to  prolong 
the  system  lifetime  for  successful  mission  execution. 

A  number  of  routing  protocols  have  been  proposed 
based  on  the  concept  of  trust  (or  reputation)  to  isolate  self¬ 
ish  nodes  [13-19].  Refaei  et  al.  [13]  proposed  a  reputation- 
based  mechanism  using  various  types  of  reputation  func¬ 
tions  and  identified  the  optimal  scheme  that  reduces  false 
positives  and  isolates  selfish  nodes.  He  et  al.  [14]  also  pro¬ 
posed  a  reputation-based  trust  management  scheme  using 
an  incentive  mechanism,  called  SORI  (Secure  and  Objective 
Reputation-based  Incentive),  to  encourage  packet  forward¬ 
ing  and  discourage  selfish  behaviors  based  on  reputation 
propagation  by  a  one-way  hash  chain  authentication.  Pisi- 
nou  et  al.  [15]  devised  a  secure  AODV  (Ad  hoc  On  Demand 
Distance  Vector)  based  routing  protocol  for  multi-hop  ad 
hoc  networks  to  find  a  secure  end-to-end  route  free  of 
black  hole  attack,  route  injection,  and  selfish  nodes.  Solta- 
nali  et  al.  [16]  proposed  a  distributed  mechanism  to  deal 
with  selfish  nodes  as  well  as  to  encourage  cooperation  in 
MANETs  based  on  a  combination  of  reputation  and  incen¬ 
tives.  Moe  et  al.  [17]  proposed  a  trust-based  routing  proto¬ 
col  based  on  an  incentive  mechanism  to  discourage  selfish 
behaviors,  using  a  hidden  Markov  model  (HMM)  to  quanti¬ 
tatively  measure  the  trustworthiness  of  nodes.  Adams  et  al. 
[18]  proposed  a  node-centric  reputation  management 
scheme  that  considers  feedback  of  a  node’s  behavior  in 
generating  a  reputation  index  in  order  to  determine  trust¬ 
worthiness  of  its  peers  before  establishing  IPSec  security 
associations.  Velloso  et  al.  [19]  proposed  a  human-based 
model  which  describes  a  maturity-based  trust  relationship 
between  nodes  in  MANETs. 

These  trust-based  schemes  cited  above  [13-19]  in  gen¬ 
eral  aim  to  isolate  or  discourage  selfish  behaviors  of  partic¬ 
ipating  nodes.  Moreover,  the  trust  metric  used  frequently 
does  not  adequately  consider  unique  properties  of  trust 
in  a  MANET  environment,  including  subjectivity,  asymme¬ 
try,  incomplete  transitivity,  dynamicity,  and  context- 
dependency  [20].  Our  work  takes  these  properties  into 
consideration  and  adopts  a  trust  metric  that  reflects  both 
social  trust  derived  from  social  networks  and  QoS  (qual- 
ity-of-service)  trust  derived  from  communication  net¬ 
works.  Our  interest  is  not  so  much  in  isolating  selfish 
nodes  but  in  quantifying  the  tradeoff  between  individual 
and  global  welfare,  allowing  each  node  to  adapt  to  network 
dynamics  and  node  status. 

In  game  theory  (or  Nash  equilibrium),  an  entity  is  as¬ 
sumed  to  be  rational  to  maximize  its  own  payoff,  which 
is  usually  regarded  as  selfish.  Most  existing  work  used  re¬ 
wards  or  incentives  to  entice  cooperativeness  and  discour¬ 
age  selfishness  so  that  each  entity  makes  moves  to  obtain 
the  best  individual  payoff.  In  this  work,  we  reveal  that  each 
node  can  actually  dynamically  adapt  its  behavior  to 
achieve  both  its  individual  goal  and  global  goal.  A  behavior 
model  is  proposed  modeling  an  entity’s  altruism  vs.  self¬ 
ishness  behavior  such  that  when  it  has  a  global  view  to 
execute  a  mission  successfully  which  requires  its  longev¬ 
ity,  it  can  be  temporarily  selfish  to  save  its  energy  so  it 
can  contribute  to  successful  mission  execution.  While  tra¬ 
ditional  game  theoretic  approaches  are  solely  based  on  a 
node’s  rationality,  being  selfish  or  cooperative  to  maximize 


Please  cite  this  article  in  press  as:  J.-H.  Cho,  I.-R.  Chen,  On  the  tradeoff  between  altruism  and  selfishness  in  MANET  trust  management,  Ad 
Hoc  Netw.  (2013),  http://dx.doi.Org/10.1016/j.adhoc.2013.05.004 


ARTICLE  IN  PRESS 


J.-H.  Cho,  I.-R.  Chen /Ad  Hoc  Networks  xxx  (2013)  xxx-xxx  3 


its  payoff,  our  approach  proposes  an  adaptive  strategy  of 
“altruistic  selfishness”  (providing  service  to  increase  trust¬ 
worthiness  for  not  being  isolated  from  the  network)  or 
“selfish  altruism”  (saving  energy  to  prolong  the  node  life¬ 
time  so  as  to  contribute  to  successful  mission  execution) 
to  best  balance  altruistic  behavior  vs.  selfish  behavior. 

Researchers  have  taken  economic  perspectives  in  mod¬ 
eling  network  behaviors  and  solving  practical  service  prob¬ 
lems  in  telecommunication  systems  [21-27].  Marbach  and 
Qiu  [21  ]  took  a  market-based  approach  to  encourage  coop¬ 
eration  among  nodes  in  MANETs  by  charging  the  service 
for  relaying  data  packets.  Aldebert  et  al.  [22]  analyzed  res¬ 
idential  demand  by  traffic  destination  using  the  demand 
and  pricing  (DP)  theory.  Yilmaz  and  Chen  [23]  utilized 
the  DP  theory  to  model  an  admission  control  algorithm 
with  the  goal  of  revenue  optimization  with  QoS  guarantees 
in  wireless  cellular  networks.  Rappaport  et  al.  [24]  ana¬ 
lyzed  a  consumer  survey  to  estimate  household  demand 
for  wireless  internet  access.  Kamioka  and  Yanada  [25]  used 
the  DP  theory  to  explain  the  relationship  between  the  ser¬ 
vice  demand  of  source  nodes  and  the  service  supply  of  re¬ 
lay  nodes.  Xi  and  Yeh  [26]  investigated  pricing  games  in 
multi-hop  relay  networks  where  selfishly  and  strategically 
behaving  nodes  charge  their  service  and  accordingly  route 
their  traffic.  Chen  et  al.  [27]  proposed  a  fair-pricing  focused 
incentive  mechanism  to  encourage  cooperation  in  MAN¬ 
ETs.  Different  from  the  works  cited  above  [21-27],  we 
use  the  DP  theory  to  model  the  selfish  and  altruistic  behav¬ 
iors  of  a  node  in  MANETs. 

Recently  trust  has  been  applied  to  security  applica¬ 
tions  such  as  secure  routing  or  intrusion  detection  in 
MANETs  [36].  Bao  et  al.  [34]  proposed  a  cluster-based 
hierarchical  trust  management  protocol  for  large-scale 
wireless  sensor  networks  (WSNs)  to  effectively  deal  with 
selfish  or  malicious  nodes.  They  tested  their  proposed 
protocol  to  maximize  security  application  performance 
in  secure  routing  and  intrusion  detection.  Fung  et  al. 
[35]  proposed  Dirichlet-based  trust  management  to  mea¬ 
sure  the  level  of  trust  among  intrusion  detection  systems 
according  to  their  mutual  experience  including  the  de¬ 
gree  of  acquaintance  between  two  entities.  However, 
these  works  [34,35]  do  not  consider  the  balance  between 
a  node’s  selfish  behavior  and  altruistic  behavior  to  maxi¬ 
mize  the  system  goal. 

Different  from  existing  work  cited  above,  the  goal  of 
this  work  is  not  to  use  the  proposed  behavior  model  to 
determine  whether  to  trust  a  node  or  not.  Our  goal  is  to 
demonstrate  that  when  nodes  can  balance  altruistic  behav¬ 
ior  (i.e.,  providing  high  service  availability)  vs.  selfish 
behavior  (i.e.,  saving  energy)  in  accordance  with  the  DP 
theory,  the  system  reliability  can  be  improved  compared 
with  pure  altruistic  or  pure  selfish  behaviors. 

The  contributions  of  this  work  are  as  follows.  First,  we 
develop  and  analyze  a  selfishness  vs.  altruism  behavior 
model  for  a  mission-driven  GCS  in  MANETs  where  nodes 
may  behave  selfishly.  We  use  the  DP  theory  to  quantify 
the  conflicts  between  individual  welfare  and  global  wel¬ 
fare,  and  identify  the  condition  to  best  prolong  the  system 
lifetime  for  successful  mission  execution  while  satisfying 
performance  requirements.  Second,  we  propose  a  compos¬ 
ite  trust  metric  encompassing  social  trust  for  sociability 


and  QoS  trust  for  performance  capability.  This  composite 
trust  metric  allows  us  to  cover  a  wide  range  of  GCS  appli¬ 
cations  with  humans  in  the  loop  carrying  communication 
devices  to  execute  a  mission  assigned.  Third,  we  develop 
a  reliability  metric,  called  the  mission  success  probability, 
to  predict  the  degree  of  successful  mission  completion 
for  a  trust-based  GCS.  This  metric  uniquely  reflects  the  im¬ 
pact  of  trust  management  on  system  reliability.  Fourth,  we 
develop  a  mathematical  model  to  describe  the  proposed 
GCS  based  on  hierarchical  Stochastic  Petri  Nets  (SPN) 
[37],  allowing  optimal  conditions  to  be  identified  to  an¬ 
swer  what-if  types  of  questions  for  operational  and  envi¬ 
ronmental  condition  changes.  Fifth,  we  demonstrate  that 
our  DP  behavior  model  exploiting  the  tradeoff  between 
selfishness  vs.  altruism  is  capable  of  maintaining  an 
acceptable  trust  level  while  achieving  a  high  mission  suc¬ 
cess  probability  and  a  prolonged  system  lifetime,  com¬ 
pared  to  both  a  purely  altruistic  system  and  a  purely 
selfish  system. 

This  paper  significantly  extends  our  preliminary  work 
published  in  [32].  Compared  to  [32],  this  paper  has  new 
contributions  including:  (1)  a  new  composite  trust  met¬ 
ric  (Section  2.3);  (2)  a  new  trust-based  reliability  metric 
to  predict  the  mission  success  probability  (Section  3.3); 

(3)  an  analysis  comparing  the  DP  behavior  model  with 
the  two  baseline  behavior  models  in  terms  of  the  trust 
level  obtained,  the  percentage  of  cooperative  nodes  ob¬ 
tained,  and  the  trust-based  reliability  assessment;  and 

(4)  an  analysis  of  the  DP  behavior  model  by  varying 
key  design  parameters  to  investigate  its  usefulness  in 
practice. 

The  rest  of  this  paper  is  organized  as  follows.  Section  2 
describes  the  system  model,  including  the  trust  protocol 
description,  assumptions,  trust  metric,  energy  model,  and 
behavior  model.  Section  3  develops  a  performance  model 
based  on  hierarchical  SPN  subnets.  In  addition,  Section  3 
discusses  and  defines  the  mission  success  probability  as 
the  trust-based  reliability  metric  to  predict  trust-based 
system  survivability.  Section  4  analyzes  numerical  results 
obtained  through  the  evaluation  of  our  SPN  performance 
models.  In  particular,  we  perform  a  comparative  analysis 
of  the  DP  behavior  model  against  a  solely  altruistic  model 
and  a  solely  selfish  model.  We  also  investigate  the  sensitiv¬ 
ity  of  our  results  with  respect  to  critical  design  parameters. 
Finally,  Section  5  concludes  the  paper  and  outlines  future 
work. 

2.  System  model 

2  A.  Trust-based  cognitive  networks  for  MANETs 

Due  to  the  unique  characteristics  of  MANETs  and  the 
inherent  nature  of  the  unreliable  medium  in  wireless  net¬ 
works,  trust  management  for  MANETs  should  encompass 
the  following  trust  concepts:  it  should  be  dynamic  and  ac¬ 
count  for  uncertainty;  it  should  be  context-dependent,  and 
subjective,  and  not  necessarily  transitive  or  reciprocal.  To 
reflect  these  unique  trust  concepts  in  MANETs,  trust  man¬ 
agement  for  MANETs  should  consider  the  following  design 
features:  trust  metrics  must  be  customizable,  evaluation  of 
trust  should  be  fully  distributed  without  reliance  on  a  cen- 
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tralized  authority,  and  trust  management  should  cope  with 
dynamics  and  adverse  behaviors  in  a  tactical  MANET  [36]. 

Cognitive  networks  are  able  to  reconfigure  the  network 
infrastructure  based  on  past  experiences  by  adapting  to 
changing  network  behaviors  to  improve  scalability  (e.g., 
reducing  complexity),  survivability  (e.g.,  increasing  reli¬ 
ability),  and  QoS  (e.g.,  facilitating  cooperation  among 
nodes)  as  a  forward  looking  mechanism  [1].  We  use  this 
concept  of  cognitive  networks  to  introduce  intelligence 
into  each  node  to  adapt  to  changing  network  conditions, 
such  as  a  node’s  selfish  behavior,  node  failure  or  mobility, 
energy  exhaustion  of  a  node,  or  voluntary  disconnection 
for  energy  savings. 

In  the  initial  network  deployment,  we  assume  that 
there  is  no  predefined  trust.  Without  prior  interactions, 
the  initial  bootstrapping  will  establish  a  shallow  level  of 
trust  based  only  on  indirect  information  (e.g.,  reputation 
from  historically  collected  data  or  recommendation  by 
third  parties)  and  authentication  by  a  challenge/response 
process  (e.g.,  public  key  authentication).  Over  time,  partic¬ 
ipating  nodes  will  establish  a  stronger  trust  level  with 
more  confidence  based  on  direct  or  indirect  interactions 
and  changing  operational  and  environmental  network  con¬ 
ditions.  Our  trust  management  protocol  allows  each  node 
to  evaluate  the  overall  trust  of  other  nodes  as  well  as  to 
be  evaluated  by  other  nodes  based  on  two  factors,  social 
trust  and  QoS  trust.  Social  trust  includes  trust  properties 
for  “sociable”  purposes  while  QoS  trust  includes  QoS  prop¬ 
erties  for  mission  execution  purposes  [20]. 

Trust  decays  over  time  without  further  updates  or 
interactions  between  entities.  Node  mobility  also  hinders 
continuous  interactions  with  other  group  members,  lower¬ 
ing  the  chances  of  evaluations  of  each  other  in  the  group. 
This  includes  cases  such  as  a  node  moving  towards  other 
areas  causing  its  disconnection  from  the  current  group, 
leaving  a  group  for  tactical  mission  reasons,  and  either  vol¬ 
untary  disconnection  for  saving  power  or  involuntary  dis¬ 
connection  due  to  terrain  or  low  energy.  In  addition, 
when  we  use  the  concept  of  web  of  trust  [28],  we  obtain 
a  certain  degree  of  trust  based  on  the  length  of  the  web 
of  trust.  For  example,  when  the  length  of  the  trust  chain 
is  4,  e.g.,  A  trusts  B,  B  trusts  C,  C  trusts  D,  and  D  trusts  E, 
then,  A  may  trust  E.  However,  the  longer  the  trust  chain 
is,  the  more  is  the  decay  in  the  degree  of  trust  [28].  Note 
that  we  use  direct  trust  relationships  when  trust  informa¬ 
tion  is  passed  from  A  to  E.  Particularly,  we  call  referral  trust 
from  A  to  D  (i.e.,  A-B,  B-C,  C-D)  and  functional  trust  from 
D  to  E  (i.e.,  D-E)  [31].  Referral  trust  is  the  one  used  to  pass 
references  from  A  to  D  while  functional  trust  is  the  one 
used  to  obtain  the  trust  information  of  a  target  node  from 
D  that  directly  knows  E. 

Our  target  system  is  a  mission-driven  GCS  in  military 
tactical  MANETs  where  a  symmetric  key,  called  the  group 
key,  is  used  as  a  secret  key  for  group  communications  be¬ 
tween  group  members  [20].  Upon  a  node’s  disconnection 
from  the  group,  the  system  generates  and  redistributes  a 
new  key  so  that  non-member  nodes  will  not  be  able  to  ac¬ 
cess  a  valid  secret  group  key.  Nevertheless,  each  group 
member  keeps  old  trust  information  even  for  non-member 
nodes  so  that  the  information  can  be  reused  for  future 
interactions,  preventing  a  new  comer  attack. 


2.2.  Assumptions 

We  assume  that  the  GCS  is  in  a  MANET  environment 
without  any  centralized  trusted  entity  in  which  nodes 
communicate  through  multiple  hops.  Nodes  have  different 
levels  of  energy,  thus  reflecting  node  heterogeneity.  Each 
node  periodically  beacons  its  identification  (ID)  and  loca¬ 
tion  information  to  its  1-hop  neighbors  so  that  node  failure 
or  node  leaving  events  can  be  easily  detected  by  1-hop 
neighbors  to  support  our  trust  protocol  design.  We  con¬ 
trast  our  design  with  an  efficient  beacon-less  routing  pro¬ 
tocol  [44]  which  uses  a  relay  node  to  forward  a  beacon 
message  to  avoid  redundant  dissemination  of  the  beacon 
message  to  the  network.  Instead  of  disseminating  a  beacon 
message  to  the  entire  network,  we  limit  beaconing  to  only 
1-hop  neighbors  so  that  1-hop  neighbors  can  gain  trust 
evidence  towards  a  node  based  on  beacon  messages  re¬ 
ceived.  Accordingly  rekeying  is  done  immediately  upon 
every  membership  change,  and  all  member  nodes  are  peri¬ 
odically  aware  of  other  nodes’  location  and  their  ID  in  the 
network.  Due  to  the  goal  of  the  GCS  that  a  mission  should 
be  completed  based  on  the  collaboration  or  cooperation  of 
nodes  in  the  network,  we  consider  one  group  with  group 
members  that  intend  to  pursue  and  successfully  complete 
an  assigned  mission.  Involuntary  disconnections  or  recon¬ 
nections  caused  by  network  topology  changes  (e.g.,  net¬ 
work  split  or  merge  due  to  node  mobility  or  failure)  are 
implicitly  considered  by  a  node’s  join  or  leave  and  the  cor¬ 
responding  rekeying  cost  is  considered  in  calculating  en¬ 
ergy  consumption,  as  shown  in  Section  2.4.  A  node’s 
disconnections  or  reconnections  are  incorporated  in  calcu¬ 
lating  trust  values  of  a  node  based  on  “closeness”  compo¬ 
nent,  as  discussed  in  Section  2.3. 

We  assume  that  mobile  devices  are  carried  by  humans 
such  as  dismounted  soldiers.  We  model  group  member 
join  and  member  leave  operations  as  common  events  for 
a  GCS.  Upon  every  membership  change  due  to  join/leave, 
a  rekeying  operation  will  be  performed  to  generate  a  new 
group  key  based  on  a  distributed  key  agreement  protocol 
such  as  GDH  (Group  Diffie  Heilman)  [38].  We  assume  that 
nodes  move  randomly  in  a  MANET  environment.  The  en¬ 
ergy  consumption  rate  of  a  node  depends  on  its  status. 
The  energy  model  is  described  in  Section  2.4.  A  node’s  self¬ 
ishness  vs.  altruism  behavior  is  modeled  by  a  behavior 
model.  The  behavior  model  is  described  in  Section  2.5. 
The  mobility  model,  energy  model  and  behavior  model 
are  input  to  the  trust  management  protocol. 

We  assume  that  a  node’s  trust  value  is  being  evaluated 
based  on  direct  observations  (e.g.,  packet  dropping)  as  well 
as  indirect  observations.  Indirect  observations  are  recom¬ 
mendations  obtained  from  1-hop  neighbors  with  the  high¬ 
est  trust  values.  If  sufficient  recommenders  cannot  be 
found,  recommendations  from  all  1-hop  neighbors  can  be 
used.  Each  node  disseminates  a  status  exchange  message 
containing  its  ID  and  its  trust  evaluation  information  to¬ 
ward  its  1-hop  neighbors  (based  on  direct  observations) 
periodically.  This  will  enable  each  node  to  compute  trust 
values  of  other  nodes  considering  the  original  recommen¬ 
dations  from  the  1-hop  neighbors  of  a  target  node  as  well 
as  the  reliability  of  the  path  that  the  trust  information  is 
obtained.  It  is  assumed  that  each  node  can  observe  behav- 


Please  cite  this  article  in  press  as:  J.-H.  Cho,  I.-R.  Chen,  On  the  tradeoff  between  altruism  and  selfishness  in  MANET  trust  management,  Ad 
Hoc  Netw.  (2013),  http://dx.doi.Org/10.1016/j.adhoc.2013.05.004 


ARTICLE  IN  PRESS 


J.-H.  Cho,  I.-R.  Chen /Ad  Hoc  Networks  xxx  (2013)  xxx-xxx  5 


iors  of  1-hop  neighbors  and  compute  interested  trust  com¬ 
ponent  values  based  on  the  direct  observations  using  a 
reputation  monitoring  mechanism  pre-installed  such  as 
Watchdog  or  Pathrater  [33].  When  each  node  receives 
the  status  exchange  messages,  it  can  calculate  trust  based 
on  desired  trust  availability  and  required  path  reliability. 
Trust  availability  is  the  probability  that  a  target  node  exists 
within  an  n-hop  distance  from  the  evaluator’s  location 
where  n  refers  to  the  length  of  a  trust  chain  used.  That  is, 
as  n  increases,  trust  availability  increases.  On  the  other 
hand,  when  a  target  node  is  found  within  n  hops  from 
the  evaluator’s  location,  the  reliability  of  a  route  taken  by 
referral  trust  recommenders  (called  path  reliability)  to 
pass  the  trust  information  (recommendation)  from  the 
functional  trust  recommender  of  the  target  node  will  de¬ 
crease.  We  calculate  the  path  reliability  by  the  product  of 
referral  trust  values  of  all  referral  trust  recommenders 
where  the  referral  trust  value  is  measured  by  unselfishness 
(a  trust  component  considered  in  our  trust  management 
protocol),  measuring  the  protocol  compliance  of  a  referral 
trust  recommender.  We  will  discuss  path  reliability  in 
more  detail  in  Section  2.3.  As  n  increases,  the  path  reliabil¬ 
ity  decreases.  Based  on  this  tradeoff,  each  node  cognitively 
and  adaptively  adjusts  the  length  of  its  trust  chain  in  order 
to  collaborate  with  more  nodes  to  achieve  the  desired  trust 
availability  while  maintaining  the  required  path  reliability. 

We  consider  the  presence  of  outside  attackers.  We  as¬ 
sume  that  existing  prevention  techniques  such  as  encryp¬ 
tion,  authentication,  or  rekeying  inhibit  outsider  attacks. 
We  consider  the  presence  of  both  selfish  nodes  and  com¬ 
promised  nodes  among  legitimate  group  members.  We 
distinguish  selfish  nodes  from  compromised  nodes  in  that 
a  selfish  node  can  adjust  its  status  from  selfish  to  unselfish 
or  unselfish  to  selfish  depending  on  the  network  condi¬ 
tions  while  a  compromised  node  performs  packet  dropping 
attacks  and  stays  selfish  continuously.  We  model  the 
behaviors  of  a  selfish  node  by  the  DP  theory,  as  described 
in  Section  2.4. 

2.3.  Trust  management  protocol 

We  consider  a  trust  metric  that  spans  two  aspects  of  the 
trust  relationship.  First,  social  trust  [30]  will  be  evaluated 
through  social  networks  to  account  for  social  relationships. 
We  consider  closeness  for  social  trust  where  closeness  is 
measured  by  the  number  of  1-hop  neighbors  a  node  has. 
Second,  QoS  trust  accounts  for  the  capability  of  a  node  to 
complete  a  given  mission.  We  consider  the  energy  level 
and  degree  of  unselfishness  (or  cooperativeness)  to  estimate 
the  QoS  trust  level  of  a  node.  A  node’s  trust  value  changes 
dynamically  to  account  for  trust  decay  over  time  due  to 
node  mobility  or  failure,  as  the  trust  chain  becomes  longer, 
as  the  node’s  energy  level  changes,  and  as  the  node  be¬ 
comes  selfish  or  unselfish. 

We  define  a  node’s  trust  level  as  a  continuous  real  num¬ 
ber  in  the  range  of  [0,1],  with  1  indicating  complete  trust, 
0.5  ignorance,  0  complete  distrust.  The  overall  trust  value 
is  derived  based  on  three  trust  components  explaining 
the  status  of  a  node  in  terms  of  energy  (probability  of  being 
alive  with  remaining  energy  ^  energy  threshold,  Tenergy), 
unselfishness  (i.e.,  probability  of  being  unselfish  while  for¬ 


warding  packets),  and  closeness  (i.e.,  number  of  1-hop 
neighbors). 

Below  we  describe  how  the  trust  value  is  calculated. 
Our  trust  metric  reflects  three  components  as  mentioned 
above:  unselfishness,  energy,  and  closeness.  The  subjective 
trust  evaluation  of  node  i  toward  node  j  inherently  hinges 
on  the  length  of  the  trust  chain  between  i  and  j.  Specifically 
the  trust  value  (T":hop(t))  of  node  j  as  evaluated  by  node  i 
over  a  n-hop  trust  chain  is  given  by: 

r"jhop(f)  =  ^wxr"jhop'x(t)  (i) 

xeX 

Three  trust  components  shown  in  Eq.  (1)  are  weighted 
by  wx  where  the  set  x  includes  unselfishness,  energy,  and 
closeness. 

Next  we  describe  how  the  trust  value  of  node  j  in  com¬ 
ponent  x  as  evaluated  by  node  i,  T^hop,x(t),  is  obtained.  If 
the  length  of  the  trust  chain  separating  node  i  from  node 
j  is  not  greater  than  the  maximum  length  of  a  trust  chain 
(i.e.,  n  hops),  node  i  can  update  node  j’s  trust  value  at  time 
t  with  both  direct  and  indirect  information  collected.  If 
node  j  cannot  be  found  within  n  hops,  node  i  relies  on  node 
j’s  past  trust  value  with  some  decay  considered.  Reflecting 
these  two  cases,  T":hop,x(t)  is  calculated  by: 

jSTjj hoP’*(t  -  At)  +  (1  -  ^)T»:hop,indirect-x(t)  jf  ^  „ 
e-PAtjn-hop,x  ^  ^  otherwise 

(2) 

In  Eq.  (2),  when  node  j  is  found  within  n  hops  from  node 
z’s  location  (H(z,j)  ^  n  where  H(z,j)  is  the  hop  distance  be¬ 
tween  nodes  i  and  j),  both  direct  and  indirect  information 
are  used  to  derive  the  trust  value  of  node  j  evaluated  by 
node  z.  Otherwise,  the  trust  value  at  time  t  is  evaluated 
based  on  past  trust  information  at  time  t  -  At  with  the  de¬ 
cay  factor  e~p  At  to  consider  the  staleness  where  p  is  a  con¬ 
stant  to  normalize  the  decay.  Note  that  Eq.  (2)  is  applied 
only  when  node  j  exists  in  the  system.  When  node  j  does 
not  exist  in  the  system  due  to  energy  depletion,  node  j’s 
trust  value  will  drop  to  zero.  In  Eq.  (2),  /3  is  used  as  a  weight 
for  the  node’s  own  information,  that  is,  “self-information” 
based  on  the  past  experience  using  trust  value  at  time 
(t  -  At),  and,  conversely,  1  -  p  is  the  weight  for  indirect 
information  using  recommendations,  that  is,  the  “other- 
information.” 

The  probability  that  node  j  is  found  within  rz  hops  from 
node  z,  denoted  by  P"'hop(t),  can  be  computed  by: 

p-hop(t)  =  £qf:hop  where  qfjhop(t) 

k= 1 

=  ^(P^\t)Pfc-m(t))  (3) 

(l,m)S 

Here  S  is  a  set  covering  all  (l,zn)  pairs  with  the  distance  be¬ 
tween  l  and  m  being  k  hops  away;  P^hop(t)  is  the  cumula¬ 
tive  probability  that  the  hop  distance  between  two 
nodes  ^  rz;  qfjhop(t)  is  the  probability  that  the  hop  distance 
between  two  nodes  is  equal  to  k;  and  P|oc=fe(t)  is  the  prob¬ 
ability  that  node  z  is  located  in  area  k. 
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Indirect  information  for  trust  component  x  at  time  t 
using  a  n-hop  trust  chain,  p^op. indirect-* jn  Eq_  (2)  js  com- 
puted  by: 


yn-hop,indirect-x 
1  J'J 


(0 


E/T-n-hop,PR  /fAT-di 
meSy1 


irect-x 

mj 


|S| 


(t)) 


(4) 


In  Eq.  (4),  S  is  the  set  of  functional  trust  recommenders, 
that  is,  the  set  of  1-hop  neighbors  of  node  j  that  know 
about  node  j  most.  In  Eq.  (4),  T"~h^p,PR(t)  refers  to  the  path 
reliability  for  the  route  between  nodes  i  and  m,  computed 
by  the  product  of  direct  unselfishness  trust  values  of  all 
pairwise  intermediate  nodes  between  nodes  i  and  m  along 
the  path.  This  process  reflects  an  incomplete  transitivity  of 
trust  in  MANETs.  That  is,  trust  decays  as  it  propagates,  or  as 
the  trust  chain  grows.  Note  that  based  on  Josang  et  al.  [31  ], 
we  use  referral  trust  with  TIn"h^p,PR(t)  and  functional  trust 
with  T^ect'x(t)  (discussed  in  Eq.  (5)).  Consequently, 

Tn:hop,indirect-x(t)  [s  derived  5ased  on  direct  trust  relation¬ 
ships  of  all  intermediate  nodes  between  nodes  i  and  j  to 
ensure  independence  of  trust  values  of  intermediate  nodes 
involved  [31]. 

The  trust  value  of  node  j  in  component  x  as  evaluated  by 
node  i  based  on  direct  evidence  observed  by  node  i  at  time 
t,  Tfjrect'x(t),  in  Eq.  (4)  is  obtained  by: 


rdirect-*(f)  =  min 


M  i 

w 


where  T?jrect-x(0)  =  1 


(5) 


the  scope  of  the  paper.  For  the  purpose  of  achieving  the 
goal  of  the  paper,  we  have  selected  three  trust  compo¬ 
nents,  namely,  energy,  unselfishness,  and  closeness,  to  re¬ 
veal  the  tradeoff  between  altruistic  behavior  (i.e., 
providing  high  service  availability)  vs.  selfish  behavior 
(i.e.,  saving  energy),  and  we  have  considered  a  mission  sce¬ 
nario  for  which  all  trust  components  are  weighted  equally. 

We  apply  a  model-based  analysis  in  this  paper  utilizing 
a  SPN  model  to  describe  the  behaviors  of  nodes  following 
their  mobility  model  (random  movement),  energy  model 
(Section  2.4)  and  selfishness  vs.  altruism  behavior  model 
(Section  2.5)  assumptions.  The  underlying  model  of  the 
SPN  model  is  a  semi-Markov  model  which,  after  being 
solved,  yields  the  probability  that  a  node  is  in  a  particular 
state  at  time  t.  For  example,  node  i  is  in  area  k  at  time  t, 
pi°c=fe(t),  js  an  0UtpUt  of  the  SPN  model.  The  actual  “ground 
truth”  status  of  node  j  in  component  x  at  time  t,  P*(t),  is 
also  output  of  the  SPN  model,  which  can  be  used  to  calcu¬ 
late  objective  trust  according  to  Eq.  (7).  We  will  describe 
our  performance  model  later  in  detail  in  Section  3.  Here 
we  note  that  objective  trust  in  Eq.  (7)  refers  to  trustworthi¬ 
ness  mentioned  in  [31],  representing  the  “objective”  trust 
level.  We  use  objective  trust  as  a  sanity  check  to  ensure 
accuracy  of  our  measured  trust  values  based  on  Eqs.  (1)- 
(6). 

2.4.  Energy  model 


In  Eq.  (5),  we  reflect  the  subjective  characteristic  of 
trust  by  dividing  node  j’s  trust  in  x  (P*(t))  by  node  i’s  trust 
in  x  (P*(t)).  We  assume  that  all  nodes  are  trustworthy  with 
a  trust  value  of  1  at  time  t  =  0.  We  also  assume  that  direct 
trust  evaluation  is  close  to  actual  status,  so  P*(t)  for 
x  =  unselfishness  or  energy  can  be  directly  obtained  from 
our  SPN  model  output  which  yields  actual  node  status, 
while  the  P?(t)  value  for  x  =  closeness  should  be  computed 
based  on  location  information  (P[oc  =  l(t)  where  l  indicates 
a  particular  area).  When  x  =  closeness,  p^loseness( t)  refers  to 
the  degree  of  node  i’s  average  closeness  toward  any  node 
at  time  t  and  is  computed  by: 

1-hop/f.N 

pcloseness/£\  _  llj  /g\ 

1  '  '  ^max-hop  ^  '  ' 

where  n}~hop(t)  is  the  number  of  1-hop  neighbors  of  node  i 
at  time  t,  and  n]nax'hop(t)  is  the  total  number  of  nodes  in  the 
system  except  node  i  at  time  t.  That  is,  p^loseness(t)  means 
the  closeness  of  node  i  toward  any  node. 

To  assess  the  accuracy  of  “subjective”  trust  obtained 
from  Eq.  (1),  we  compare  it  against  “objective”  trust  calcu¬ 
lated  based  on  the  node’s  actual  status.  Specifically,  the 
objective  trust  of  node  i  is  calculated  by: 

7f(t)=J>P*(t)  (7) 

xeX 

Here  P*(t)  is  the  “ground  truth”  status  of  node  j  in  x  at  time 
t. 

Dynamic  trust  formation  by  adjusting  the  weights  asso¬ 
ciated  with  trust  components  to  optimize  application  per¬ 
formance  in  response  to  dynamically  changing  conditions 
is  an  important  research  area  [32,34],  but  is  outside  of 


In  this  section,  we  discuss  the  communication  over¬ 
heads  of  beaconing,  group  communication,  status  ex¬ 
change,  and  rekeying  operations  in  our  protocol  design  in 
terms  of  message  traffic  generated  (i.e.,  bits  generated 
per  second)  and  energy  consumption  rate  per  node  for 
these  operations.  Since  the  application  is  a  MANET  group, 
rekeying  and  group  communication  packets  are  dissemi¬ 
nated  to  legitimate  members  through  hop-by-hop  multi¬ 
casting,  while  beaconing  and  status  exchange  packets  are 
disseminated  to  only  1-hop  neighbors  based  on  our  proto¬ 
col  design. 

The  energy  model  describes  the  amount  of  energy  con¬ 
sumed  when  a  node  is  in  a  particular  state.  It  is  an  input  to 
our  trust  management  protocol.  We  associate  the  energy 
level  of  a  node  with  its  status  in  selfishness  and  group 
membership.  Depending  on  the  remaining  energy,  each 
node  acts  differently.  The  degree  of  energy  consumption 
is  also  affected  by  the  node’s  state.  Thus,  these  parameters 
are  interwoven  and  affect  a  node’s  lifetime  significantly. 

A  GCS  in  MANETs  must  handle  events  such  as  beacon¬ 
ing,  group  communication,  rekeying,  and  status  exchange. 
In  particular,  after  a  status  exchange  event,  trust  evalua¬ 
tion  towards  1-hop  neighboring  nodes  as  well  as  distant 
nodes  may  be  performed.  Each  node  may  transmit  its 
own  status  (e.g.,  information  providing  the  trust  values) 
as  well  as  status  of  other  nodes  (i.e.,  trust  values)  on  a  trust 
chain.  Recall  that  we  use  recommendations  from  1-hop 
neighbors  for  trust  evaluation. 

We  design  the  transmission  packet  format  (bits)  based 
on  [HMAQ<g|(H|D)Kg]  where  the  main  message,  encrypted 
by  a  group  key  J(G,  consists  of  header  H  and  data  payload 
D.  A  hash-based  message  authentication  code  (HMAC) 
using  a  MAC  key  derived  from  I<G  is  used  to  ensure  message 
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integrity  and  authentication.  Typically  the  size  of  MAC  is 
128  or  160  bits  in  the  case  of  MD5  or  SHA-1  respectively 
[50].  This  allows  us  to  estimate  energy  consumption  upon 
packet  transmission  and  reception  in  our  energy  model. 

The  energy  consumption  per  bit  for  transmission  is  esti¬ 
mated  by  [29]: 

pt(U)  =  M(U)  (8) 


where  d(i,j)  is  the  distance  between  transmitter  i  and  re¬ 
ceiver  j,  v  is  the  path-loss  factor  (typically,  2  ^  v  ^  6),  and 
a  i  is  a  distance-independent  parameter.  For  simplicity, 
we  use  ai  =  10-11  [29],  and  d(i,j)  =  R,  the  wireless  radio 
range.  Hence,  we  have  Pt  =  10-11  *  ( R )2  for  the  energy  con¬ 
sumption  per  bit  at  a  transmitter,  assuming  v=2.  The  en¬ 
ergy  consumption  per  second  for  data  transmission  by  a 
node  is  given  by: 

Psend  =  Pt[A  +  BN"  +  CN^I^p]  (9) 


The  first  term  is  for  energy  consumption  for  transmis¬ 
sion  initiated  by  a  node  where  A  represents  bits  generated 
per  second  covering  beaconing,  group  communication,  sta¬ 
tus  exchange,  and  rekeying  operations.  The  second  term  is 
for  energy  consumption  for  forwarding  packets  from 
unselfish  1-hop  neighbors  (N^plsh)  where  B  represents 
bits  generated  per  second,  covering  the  messages  for  group 
communication,  and  rekeying  operations  to  be  dissemi¬ 
nated  to  all  group  members  using  multicasting.  Beaconing 
and  status  exchange  messages  are  not  required  to  be  dis¬ 
seminated  to  all  group  members,  so  they  are  excluded 
from  forwarding.  The  third  term  indicates  the  energy  con¬ 
sumption  for  transmitting  packets  from  selfish  1-hop 
neighbors  (Nf“s0hp)  who  do  not  forward  group  communica¬ 
tion  packets  received  from  others,  with  C  representing  bits 
generated  per  second  for  rekeying  operations.  We  note 
that  JVrhs0eplsh  is  set  to  the  average  number  of  1-hop  neigh¬ 
boring  nodes,  and  N\e^  is  set  to  zero  in  the  first  round 
of  iterations  of  the  SPN  subnet  based  on  the  assumption 
that  all  neighbors  are  unselfish.  From  the  second  round 
of  iterations,  the  estimates  of  N“n^plsh  and  N\e^  obtained 
at  the  end  of  the  previous  round  of  iterations  are  used. 
Note  that  N“n^plsh  and  N\e^  are  time-averaged  values; 
they  reflect  the  average  behavior  of  the  system  and  can 
be  estimated  after  the  first  round  of  iterations.  Node  f s 
^u-hohp  is  calculated  as: 


jyrselfish 

^i,l-hop 


Emax  v—vNarea  nloc=fc  / .  \  j  loc=y 

t=0  2-^k=  1  *  i  ) 2^/y selfish 


N 


interval 


j  lo  c=k 
Li,  selfish 


(0=  E&(t) 


jeSMS 


(10) 

(11) 


selfish  and  located  at  area  k.  Both  P[oc  k(t)  and  P]°sceiffsh(t) 
can  be  obtained  from  the  SPN  model  output.  opSh  is  cal¬ 
culated  by  the  average  number  of  1-hop  neighbors  minus 
^n-hop-  Henceforth,  we  omit  the  symbol  i  in  N^h  and 
^n-hop  for  simplicity. 

Assume  that  a  node  may  leave  the  group  voluntarily 
with  rate  /u  and  may  rejoin  the  group  with  rate  2.  Then, 
the  probability  that  a  node  is  in  the  group  is  2/(2  +  /a)  and 
the  probability  that  it  is  not  is  /i/(2  +  ju).  Then,  the  rekeying 
interval  Trekeying  is  calculated  as: 

hekeying  =  1  /  AJ+L  where  A l+L  =  TTT,  (1 2) 

A  ~r  fi 

where  AJ+L  is  the  aggregate  join  and  leave  rate  in 
equilibrium. 

The  energy  consumed  in  reception  is  typically  less  than 
that  for  transmission;  we  assume  Pr  =  Pt/2  and  do  not  con¬ 
sider  energy  consumed  in  idle  listening.  The  energy  con¬ 
sumed  per  second  by  each  member  node  for  packet 
reception  from  1-hop  neighbors  is  calculated  by: 

Preceive  =  Pr[AN™s0e;flsh  +  DNfh%h]  (13) 

where  A  is  the  same  as  in  Eq.  (9)  and  D  represents  bits  re¬ 
ceived  per  second  for  beacon,  status  exchange,  rekeying, 
and  group  communication  messages  for  which  the  selfish 
1-hop  neighboring  nodes  transmit.  In  Eq.  (13),  the  first 
term  represents  the  energy  consumed  by  receiving  packets 
forwarded  from  healthy  1-hop  neighbors  (N“nj^plsh)  and  the 
second  term  indicates  the  energy  consumed  by  receiving 
packets  forwarded  from  selfish  1-hop  neighbors  (N^p ). 

In  summary,  the  consumed  energy  of  a  node  per  second 
is: 

P  —  ^send  "F  P  receive  (14) 

If  a  member  node  is  selfish,  it  does  not  forward  any 
packet  from  others  but  just  transmits  its  own  packets. 
The  energy  consumption  per  second  for  data  transmission 
by  a  selfish  node  is  given  by: 


f^send,  selfish  —  PfA  (15) 

If  a  member  node  is  selfish,  the  energy  consumption  per 
second  for  receiving  packets  is  also  Preceive  since  we  assume 
all  nodes  are  in  promiscuous  mode.  Thus,  the  node  will 
save  PSend  -  Psend, selfish  energy  by  being  selfish.  Thus,  the  to¬ 
tal  energy  consumption  for  a  selfish  node  per  second  is: 

^selfish  —  f^send, selfish  T-  Preceive  (16) 


In  Eq.  (11),  S  includes  all  nodes’  IDs  except  node  i  and 
elfish (0  is  the  number  of  selfish  nodes  in  area  k  except 
for  the  case  that  node  i  is  selfish  in  area  k  at  time  t.  Simi¬ 
larly,  elfish  (t),  where  y  is  an  element  of  Y  that  includes  k 
location  itself,  north,  south,  west,  and  east  of  area  k  as 
the  1-hop  neighbor  areas,  gives  the  number  of  1-hop 
neighbor  selfish  nodes  in  areas  in  Y,  max  is  the  upper 
bound  of  time  measured  and  Nintervai  is  the  number  of  time 
points.  P[oc=fe(t)  is  the  probability  that  node  i  is  located  in 
area  k  at  time  t.  P]0SeTfish  (0  th e  probability  that  node  j  is 


If  a  node  is  a  non-member,  it  will  only  transmit  and  re¬ 
ceive  beacon  messages.  Thus,  the  energy  consumption  per 
second  for  a  non-member  is  computed  as: 

f^non-member  —  ^send.non-member  H-  ^receive, non-member 

=  £(Pt+PrN1_h  op)  (17) 

Here  Ni_hop  includes  both  N^plsh  and  since  any 

node  that  is  alive  will  disseminate  beacon  messages,  and 
E  indicates  bits  transmitted/received  per  second  for  a  bea¬ 
con  message. 
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2.5.  Selfishness  vs.  altruism  behavior  model 

A  selfishness  vs.  altruism  behavior  model  describes  the 
behavior  of  a  node  as  it  switches  between  selfish  and  altru¬ 
istic  behavior  to  balance  its  individual  welfare  vs.  the  sys¬ 
tem  global  welfare.  It  is  an  input  to  our  trust  management 
protocol.  We  derive  a  selfishness  vs.  altruism  behavior 
model  from  the  classic  demand  and  pricing  (DP)  model 
in  the  field  of  economics  [3,22].  Henceforth,  we  will  refer 
it  as  the  DP  behavior  model.  In  the  literature,  the  DP  model 
has  been  applied  extensively  to  practical  real-world  sce¬ 
narios  in  demand  vs.  resource  consumption  behavior  in 
applications  such  as  radio  resource  allocation  in  multime¬ 
dia  communication  systems  [41,43],  distributed  energy  re¬ 
source  allocation  in  information  and  communication 
systems  [42],  and  admission  control  for  pricing  optimiza¬ 
tion  of  multiple  service  classes  in  wireless  networks  [23]. 
We  apply  the  DP  model  to  describe  the  practical  relation¬ 
ship  between  a  node’s  selfish  behavior  vs.  its  energy  status, 
the  mission  status,  and  the  environment  condition. 

The  basic  formula  to  represent  the  relationship  between 
demand  and  pricing  in  a  market  is  given  by: 

21  =  (18) 

where  21  is  the  demand  arrival  rate  of  service  i  and  if  is  the 
pricing  of  service  i  while  yl  and  sl  are  constants  correlating 
to  2l  and  if.  Service  demand  is  affected  by  pricing  changes 
where  the  elasticity  constant  sl  is  a  key  determinant.  Cus¬ 
tomers  tend  to  purchase  a  product  when  they  can  afford 
to  buy  it  or  need  it.  If  the  increasing  speed  of  demand  is 
slower  than  that  of  pricing  of  a  product,  consumers  are 
considered  as  inelastic  to  price  changes.  Conversely,  if 
the  increasing  speed  of  demand  is  faster  than  that  of  pric¬ 
ing  of  a  product,  consumers  are  regarded  as  elastic  to  pric¬ 
ing  changes.  Usually  the  elasticity  sl  is  greater  than  1  in 
order  to  follow  the  general  trend  that  a  lower  price  in¬ 
creases  consumer  demand.  The  elasticity  sl  can  be  obtained 
from  statistical  data  describing  past  market  conditions. 

We  adopt  the  DP  theory  to  model  the  behavior  of  a  par¬ 
ticipating  node  particularly  on  whether  it  should  behave 
selfishly  or  altruistically  based  on  both  individual  benefit 
(i.e.,  saving  energy)  and  global  interest  (i.e.,  serving  tasks). 
To  apply  Eq.  (18)  to  model  the  selfish  behavior  of  a  node, 
we  use  a  transition  T_SELFISH  in  our  SPN  model  (discussed 
later  in  Section  3)  to  model  a  node’s  changing  behavior 
from  altruistic  to  selfish  and  vice  versa.  The  transition  rate 
for  T_SELFISH  indicates  how  often  a  node  will  switch  from 
altruistic  to  selfish  behavior  and  is  modeled  by: 

rate(T-SELFISH)  =/(£^™in)/(M^flculty)/(5degree)  (19) 

Tgc 

Applying  the  DP  theory  discussed  in  Eq.  (18),  we  use 
/(x)  =  yx~ E  where  a  node  is  more  likely  to  be  selfish  with 
large  y  and  small  s  while  it  is  less  likely  to  be  selfish  with 
small  y  and  large  s.  Eremain  represents  the  level  of  current 
energy  (mark( energy)),  Mdifficuity  is  the  difficulty  level  of  a 
given  mission  where  a  higher  number  indicates  a  tougher 
mission  with  more  workload,  and  Sdegree  is  the  degree  of 
selfishness  where  a  higher  number  refers  to  more  selfish¬ 
ness.  We  define  5degree  as  the  degree  of  selfish  nodes  to 


unselfish  nodes  among  1-hop  neighbors.  Note  that  when 
x  in/(x)  is  large,  then  a  node  is  more  likely  to  be  altruistic. 
That  is,  when  Eremajn,  IVfdifficuity  or  5degree  is  large,  then  a 
node  tends  to  be  altruistic  because  it  has  a  sufficient  level 
of  energy,  the  mission  is  difficult,  or  few  neighboring  nodes 
are  available  to  serve  the  mission.  On  the  other  hand,  when 
a  node  has  low  energy,  the  mission  is  light-workload,  or 
many  altruistic  neighbors  are  around,  the  node  is  more 
likely  to  be  selfish  so  as  to  save  energy  to  participate  in 
mission  execution.  The  DP  theory  is  utilized  to  model  a 
selfishness  vs.  altruism  behavior  scenario  in  which  nodes 
attempt  to  achieve  both  individual  benefit  (i.e.,  saving  en¬ 
ergy)  and  global  interest  (i.e.,  serving  tasks). 

We  use  three  different  thresholds  to  order  the  degrees 
of  these  three  environmental  conditions.  Thus,  Eremain, 
Mdifficuity,  And  Sdegree  are  in  the  range  of  1,  2,  or  3.  The  mul¬ 
tiplication  by  1  /Tgc  is  to  consider  an  interval  of  disseminat¬ 
ing  a  group  communication  packet  where  a  node’s 
selfishness  can  be  observed.  Eq.  (19)  implies  the  following 
physical  meanings: 

•  /(Eremain)-  If  a  node  has  a  higher  level  of  energy,  it  is  less 
likely  to  be  selfish. 

•  /(Mdifficuity)-  If  a  node  is  assigned  a  tougher  mission,  it  is 
less  likely  to  be  selfish  (so  it  would  not  risk  mission 
failure). 

•  /(^degree)-  If  a  n°de  observes  high  selfishness  among  its 
1-hop  neighbors,  it  is  less  likely  to  be  selfish  (so  it 
would  not  risk  mission  failure). 

Similarly,  we  use  a  transition  T_REDEMP  in  the  SPN 
model  (shown  in  Section  3.1)  to  model  the  redemption  of 
a  node  changing  its  behavior  from  selfish  to  altruistic. 
The  rate  to  transition  T_REDEMP  is  modeled  as: 

rate(T_REDEMP)  =  d)/(MeasinesS)/(Hdegree)  (2Q) 

I  status 

where  EConsumed  is  the  level  of  consumed  energy 
(Einit  -  mark(energy)),  Measiness  is  the  easiness  level  of  a  gi¬ 
ven  mission  where  a  higher  number  indicates  an  easier 
mission  with  less  workload,  and  Hdegree  is  the  degree  of 
unselfishness  where  a  higher  number  means  more  unself¬ 
ishness  of  1-hop  neighbors.  We  define  Hdegree  as  the  degree 
of  unselfish  nodes  to  selfish  nodes  among  1-hop  neighbors. 
The  redemption  rate  is  high  when  a  node  has  a  sufficient 
energy,  a  difficult  mission  is  given,  or  less  healthy  (or  more 
selfish)  nodes  are  available  around  the  node,  and  vice  ver¬ 
sa,  applying  the  same  rationale  in  Eq.  (19).  A  node  is  given 
a  chance  to  be  redeemed  (from  selfish  to  altruistic)  in  every 
revaluation  period  ^status*  corresponding  to  the  status  ex¬ 
change  interval  for  trust  evaluation.  Eq.  (20)  carries  the  fol¬ 
lowing  physical  meanings: 

•  /(Econsumed)-  If  a  node  has  consumed  more  energy,  it  is 
less  likely  to  redeem  itself.  This  means  that  if  a  node 
has  low  energy,  it  may  want  to  further  save  its  energy 
by  remaining  selfish. 

•  /(Measiness)-  If  a  node  is  assigned  to  an  easier  mission,  it 
is  less  likely  to  redeem  itself  (as  this  would  not  risk  mis¬ 
sion  failure). 
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•  f(H degree)-  If  a  node  observes  high  unselfishness  among 
its  1-hop  neighbors,  it  is  less  likely  to  redeem  itself 
and  may  continue  to  stay  selfish  in  order  to  save  its 
energy  (as  this  would  not  risk  mission  failure). 

3.  Performance  model 

3.1.  Hierarchical  modeling  using  SPN 

We  develop  a  mathematical  model  based  on  SPN  tech¬ 
niques  [37]  to  analyze  a  GCS  with  nodes  switching  be¬ 
tween  selfish  and  altruistic  behavior  based  on  the  DP 
theory  and  identify  design  conditions  under  which  the  self¬ 
ish  vs.  altruistic  behaviors  can  be  balanced.  With  the  trust- 
based  system  lifetime  and  the  mission  success  probability 
as  our  reliability  metrics,  we  show  that  the  DP  behavior 
model  outperforms  one  that  only  encourages  altruistic 
behaviors.  We  use  SPN  as  our  modeling  tool  due  to  its  effi¬ 
cient  representation  of  a  large  number  of  states  where  the 
underlying  models  are  semi-Markov  models.  We  develop  a 
hierarchical  modeling  technique  to  avoid  state  explosion 
problems  and  to  improve  solution  efficiency  for  realizing 
and  describing  a  large  scale  GCS. 

We  first  develop  a  “node”  SPN  subnet  to  describe  a  sin¬ 
gle  node’s  lifetime  behavior.  We  assume  that  the  opera¬ 
tional  area  is  a  square-shaped  area  comprising  m  x  m 
sub-grid  areas  with  the  width  and  height  equal  to  the  wire¬ 
less  radio  range  ( R ).  Initially  the  location  of  each  node  is 
randomly  distributed  over  the  operational  area  based  on 
uniform  distribution.  A  node  randomly  moves  to  one  of 
four  locations  in  four  directions  (i.e.,  north,  west,  south, 
and  east)  in  accordance  with  its  mobility  rate.  The  speed 
of  each  node  is  chosen  from  [0,2)  m/s  based  on  uniform 
distribution  at  the  beginning  of  network  deployment,  and 
is  then  fixed  during  its  lifetime.  The  boundary  grid  areas 
are  wrapped  around  (i.e.,  a  torus  is  assumed)  to  reuse  the 
operational  area.  The  SPN  subnet  for  node  i  computes  the 
probability  that  node  i  is  in  a  particular  grid  area  j  at  time 
t.  This  information  along  with  the  information  of  other 
nodes’  location  information  at  time  t  provides  actual  status 
information  about  a  node’s  n-hop  neighbors  at  time  t, 
which  we  will  use  to  compute  the  “objective”  trust  metric. 
Since  node  movements  are  assumed  to  be  independent,  the 
probability  that  two  nodes  are  in  a  particular  location  at 
time  t  is  given  by  the  product  of  the  two  individual  proba¬ 
bilities.  The  node  SPN  subnet  describes  a  node’s  lifetime 
behavior  and  can  be  used  to  obtain  each  node’s  status 
information  (e.g.,  amount  of  energy  left,  unselfishness  sta¬ 
tus,  and  closeness  status)  to  derive  the  trust  relationship 
with  other  nodes  in  the  system.  There  are  N  such  SPN  sub¬ 
nets,  one  for  each  node  in  the  network. 

Iterative  techniques  are  used  for  each  node  SPN  subnet 
to  obtain  other  nodes’  information  from  other  node  SPN 
subnets  since  one  subnet  only  describes  one  node’s  life¬ 
time.  In  the  first  round  of  iterations,  there  is  no  information 
available  about  1-hop  neighbors,  so  it  is  assumed  that  each 
area  has  an  equal  number  of  nodes  and  all  nodes  are 
unselfish.  In  the  second  round  of  iterations,  based  on  the 
information  collected  (e.g.,  number  of  unselfish  or  selfish 
1-hop  neighbors)  from  the  first  round,  each  node  knows 
how  many  nodes  are  1-hop  neighbors  that  can  directly 


communicate  with  it,  and  whether  or  not  they  are  mem¬ 
bers  of  the  GCS  or  selfish.  A  node  also  knows  how  many 
n-hop  neighbors  it  has  at  time  t.  It  then  adjusts  the  status 
of  1-hop  neighbors  at  time  t  with  the  output  generated 
from  the  jth  round  of  iterations  as  input  to  the  (j  + 1  )th 
round  of  iterations.  This  process  continues  until  a  specified 
convergence  condition  is  met.  The  Mean  Percentage  Differ¬ 
ence  (MPD)  is  used  to  measure  the  difference  between  crit¬ 
ical  design  parameter  values,  including  the  energy  level, 
selfish  probability,  and  closeness  probability  of  a  node  at 
time  t  in  two  consecutive  iterations.  The  iteration  stops 
when  the  MPD  is  below  1%  for  all  nodes  in  the  system  to 
assure  accuracy.  The  calculation  of  the  MPD  of  trust  prop¬ 
erty  x  of  node  i  is  given  by: 


:  Erff(t). 


MPD*  =  ^  Df(t) 

^interval 


K:+V)-*i(t)l 

*1(0 


(21) 


where  xj  (t)  indicates  the  value  of  trust  property  x  of  node  i 
at  time  t  in  the  jth  round  of  iterations,  max  is  the  maxi¬ 
mum  time  measured,  and  Nintervai  is  the  number  of  time 
points.  We  compute  the  MPD  of  trust  property  x  including 
the  energy  level,  selfish  probability,  and  closeness  proba¬ 
bility  of  a  node.  The  node  SPN  subnet  after  convergence 
yields  actual  status  expressed  in  terms  of  the  probabilities 
for  various  trust  components  (i.e.,  unselfishness,  energy, 
and  closeness)  as  output.  Leveraging  the  SPN  model  out¬ 
put,  we  are  able  to  calculate  subjective  and  objective  trust 
values  as  explained  earlier  in  Section  2.3. 

Fig.  1  shows  the  node  SPN  subnet.  The  subnet  describes 
a  node’s  mobility  behavior,  join  and  leave  events  (i.e.,  GCS 
membership  status),  energy  consumption,  and  selfish 
behaviors  with  a  redemption  mechanism  provided.  Place 
Location  holds  the  location  ID  (one  of  the  m  x  m  subareas 
each  having  a  distinct  location  ID).  If  the  current  location 
ID  is  3,  there  will  be  3  “tokens”  in  Location.  The  transition 
T_LOCATION  is  triggered  when  a  node  moves  to  a  ran¬ 
domly  selected  area  in  one  of  four  different  directions  from 
its  current  location  with  the  rate  calculated  as  Sinit/R  based 
on  an  initial  speed  (Sinit)  and  wireless  radio  range  ( R ).  For 
example,  if  a  node  moves  downward  from  location  3  to 
location  8,  then  the  number  of  tokens  in  Location  is  chan¬ 
ged  from  3  to  8  to  reflect  the  location  change.  Hence,  by 
examining  the  number  of  tokens  in  Location ,  we  know  a 
node’s  current  location. 

Place  Member  indicates  whether  a  node  is  a  member  or 
not,  with  one  token  indicating  yes  and  zero  token  indicat¬ 
ing  no.  We  assume  that  inter-arrival  times  of  a  node’s  join 
and  leave  requests  are  exponentially  distributed  with  rates 
2  and  /i,  applying  to  transitions  T_JOIN  and  T_LEAVE, 
respectively. 

Place  Energy  represents  the  current  energy  level  of  a 
node.  An  initial  energy  level  is  assigned  according  to  node 
heterogeneity  information.  In  our  analytical  model,  we 
randomly  generate  a  number  between  6  and  12  h  of  energy 
based  on  uniform  distribution.  A  token  representing  an  en¬ 
ergy  unit  is  taken  out  when  transition  T_ENERGY  fires.  The 
transition  rate  of  T_ENERGY  is  adjusted  on  the  fly  based  on 
a  node’s  status:  it  is  lower  when  a  node  becomes  selfish  to 
save  energy  or  when  a  node  changes  its  membership  from 
a  member  to  a  non-member,  following  the  energy  con- 
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TLOCATION  TJOIN  TLEAVE  T.ENERGY  TJSELFISH  T.REDEMP 


Fig.  1.  Node  SPN  subnet  for  describing  the  behavior  of  a  node. 


sumption  model  explained  in  Section  2.4.  We  assume  that 
T  seconds  will  be  taken  to  consume  one  energy  token  when 
a  member  node  has  no  selfish  1-hop  neighbors.  We  use  our 
energy  consumption  model  (see  Section  2.4)  for  adjusting 
the  time  taken  to  consume  one  token  in  place  Energy  based 
on  a  node’s  status:  a  token  is  taken  out  of  place  Energy  after 
T  (i.e.,  =(P  x  T)/P)  seconds  if  the  node  is  an  unselfish  mem¬ 
ber,  (P  x  T)/Pse Msh  if  it  is  a  selfish  member,  and  (P  x  T)/ 
^non-member  if  the  node  is  a  non-member.  Therefore, 
depending  on  the  node’s  status,  its  energy  consumption 
rate  is  dynamically  changed. 

Place  Selfish  indicates  whether  a  node  is  selfish  or  not, 
with  one  token  in  place  Selfish  representing  it  is  selfish 
and  zero  token  otherwise.  If  a  node  becomes  selfish,  a  to¬ 
ken  goes  to  Selfish  by  triggering  T_SELFISH.  When  a  node 
becomes  altruistic  again,  transition  T_REDEMP  is  triggered. 
A  node  switches  between  selfish  and  altruistic  following 
Eqs.  (19)  and  (20).  To  model  a  compromised  node  which 
performs  packet  dropping  attacks  and  stays  selfish  contin¬ 
uously,  we  disable  T_REDEMP  for  a  compromise  node 
whose  initial  status  is  selfish,  having  a  token  in  place  Selfish 
from  the  beginning. 

3.2.  Calculation  of  trust 

Subjective  trust  evaluation  is  performed  by  individual 
nodes  at  runtime.  Essentially  subjective  trust  is  calculated 
by  Eq.  (1).  Objective  trust,  on  the  other  hand,  is  calculated 
by  Eq.  (7).  Recall  that  objective  trust  is  calculated  based  on 
actual  status  and  is  used  as  a  baseline  case  against  which 
accuracy  is  assessed.  To  apply  Eqs.  (1)  and  (7),  we  need 
to  know  node  i’s  actual  status  in  trust  component  x  at  time 
t  (with  x  =  energy,  unselfishness  or  closeness),  i.e.,  Pfnergy(t), 

pimseflish^)  and  pcloseness(t)  Thjs  can  be  achieved  by  means  0f 

a  reward  assignment  technique  described  below.  Specifi¬ 
cally,  the  average  value  of  a  physical  property  at  time  t, 
Z(t),  is  the  state  probability  weighted  sum  of  the  values 
at  various  states,  i.e., 

Z(t)  =  5>Prob ,(t))  (22) 

jeS 

where  Z(t)  represents  the  average  value  of  a  general  phys¬ 
ical  property  at  time  t,S  is  a  set  of  states  that  meet  partic¬ 
ular  conditions,  Prob/t)  is  the  probability  that  the  system 
is  in  state  j  at  time  t  (which  is  output  of  our  SPN  model), 
and  r,  is  the  “reward”  or  “value”  assigned  to  the  physical 
property  at  state  j.  The  reward  assignment  technique  al¬ 
lows  us  to  compute  a  node’s  average  energy  level  probabil¬ 
ity  (Penergy(t)),  unselfish  probability  (Punselfish(t)),  the 
probability  of  being  in  area  k  {^oc=k(t)\  P^effiSh(t)  and 
^selfish  (0  needed  in  the  computation  of  subjective  trust 
(Eq.  (1))  and  objective  trust  (Eq.  (7)).  Also  with  knowledge 
of  the  probability  of  a  node  being  in  area  k  at  time  t 


(pioc=/<(t))  obtained  above,  we  can  compute  P":hop(t)  from 
Eq.  (3)  as  well  as  P closeness(f)  fr0m  Eq.  (5).  Note  that  here 
we  omit  the  subscript  i  (to  refer  to  node  i)  for  simplicity. 

Table  1  specifies  the  conditions  to  be  satisfied  for  states 
in  set  S  in  calculating  Penergy(t),  punselfish(f)t  ploc=/<(t ), 
Punsemsh(t).  and  P'°^h(t)  as  output  of  our  SPN  model.  When 
the  conditions  specified  are  satisfied,  a  reward  of  1  is  as¬ 
signed;  0  otherwise. 


3.3.  Calculation  of  trust-based  reliability 


We  develop  a  computational  procedure  for  assessing 
the  mission  reliability  based  on  the  trust  level  required 
for  successful  mission  execution.  The  reliability  of  node  j 
at  time  t,  denoted  by  R/t),  is  the  probability  that  node  j 
meets  the  required  trust  level  for  mission  execution  over 
time  [0, t],  calculated  as  follows: 


m  = 

where 


0, 

E[T(t')]  for  t'  <  t, 


W)  = 


'1, 
<  0, 


T-n-hop 

1  ij 


0 0/D2 , 


if  Tj(t')  =  0  for  any  t!  <  t 
otherwise 

if  T1""hop(t')  >  D2 
if  T"jhop(t/)  <  D, 

otherwise 

(23) 


In  Eq.  (23),  t  is  the  current  time  point  and  t!  <  t  is  a  past 
time  point,  D 1  is  the  drop  dead  trust  level,  and  D2  is  the  de¬ 
sired  trust  level  for  successful  mission  execution.  The 
physical  meaning  is  that  if  j’s  trust  level  is  below  the  drop 
dead  trust  threshold  (Di)  at  any  time  during  [0,  t]  then  R/t) 
is  zero;  otherwise,  R/t)  is  the  expected  trust  level  scaled 
over  the  desired  trust  level  (D2).  Knowledge  of  R/t)  thus 
can  be  obtained  by  node  i  (the  commander  node)  based 
on  its  subjective  trust  toward  node  j  (T^hop(t')  over  [0,t]) 
according  to  Eq.  (23)  to  decide  if  it  should  include  node  j 
as  a  group  member  to  execute  a  mission  assigned  to  ensure 
successful  mission  execution. 


4.  Numerical  results  and  analysis 

In  this  section,  we  present  numerical  results  to  compare 
subjective  trust  T":hop(t)  through  Eq.  (1),  objective  trust 
T°bj(t)  through  Eq.  (7)  and  the  reliability  of  node  j  at  time 
t,  Rj-(t),  through  Eq.  (23).  We  use  SPNP  as  a  tool  to  imple¬ 
ment  the  SPN  model  developed  and  compute 
T^hop(t),T°bj(t)  and  R/t)  based  on  reward  assignments  as 
described  in  Section  3.2.  Table  2  summarizes  the  default 
parameter  values  used  in  this  paper. 

In  our  case  study,  we  assume  that  a  mission  requires 
the  same  level  of  importance  in  three  dimensions  of  trust 
(i.e.,  energy,  unselfishness,  and  closeness).  The  example 
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Table  1 

Reward  function. 


Component  Reward  returned  based  on  conditions  in  S 


penergy^  ^ 

mark( Energy)  >  0 

punselfish^ 

(mark( Member)  >  0)  &  (mark(Selfish)  ==  0) 

&(mar/< Energy)  >  0) 

Pl°C=k(t) 

(mark( Location)  ==  k)  &(mark(Member)  >  0)  & 

(mark( Energy)  >  0) 

p£SU(0 

(mark(Member)  >  0)  &  (mark(Selfish)  ==  0)  & 
(mark(Energy)  >  0)  &  (mark( Location)  ==  k) 

p'Sfeh(t) 

(mark(Member)  >  0)  &  (mark(Selfish)  >  0)  & 
(mark(Energy)  >  0)  &  (mark( Location)  ==  k) 

Table  2 

Default  parameter  values  used. 

Parameter 

Value 

Parameter 

Value 

Parameter 

Value 

krecom 

3 

N 

150 

Di/D2 

0.5/ 

0.85 

R 

250  m 

^status 

600  s 

wx 

1/3 

2 

1/ 

3600 

^beacon 

120  s 

7 

0.01 

P 

1/ 

14400 

T 

60  *  60  s 

£ 

2 

P 

0.8 

Sinit 

(0,2)  m/s 

^init 

[6,12]  h 

yMl 

1  gc 

600  s 

tM  2 

1  gc 

360  s 

tM3 

igc 

120  s 

At 

600  s 

P 

1/3600 

n  (TC) 

4 

military  mission  scenario  can  be  found  in  navigating  and/ 
or  monitoring  for  locations  or  events  on  the  enemy  side 
where  effective  and  efficient  communications  are  vital  to 
mission  success  [46].  In  these  types  of  missions,  closeness, 
energy,  and  cooperativeness  (unselfishness)  are  critical 
fundamental  capabilities  to  make  communication  effec¬ 
tive,  leading  to  successful  mission  execution.  Thus,  we 
weigh  all  trust  components  equally,  setting  wx=l/3  to 
compute  the  overall  trust  based  on  Eq.  (1).  If  a  mission  re¬ 
quires  weapon  or  equipment  capabilities  for  destroying 
buildings/bridges  or  rescuing  personnel,  a  different  set  of 
trust  dimensions  can  be  added  such  as  functionality  (or 
diversity),  and/or  vertical  mobility  (e.g.,  airborne  infantry) 
with  a  different  level  of  importance  [46].  What  trust 
dimensions  should  be  considered  and  how  to  weigh  each 
trust  dimension  depend  on  the  mission  characteristics. 
Our  work  uses  a  weight  parameter  for  each  trust  compo¬ 
nent  so  that  the  proposed  trust  metric  can  be  generic  and 
easily  applicable  to  other  mission  scenarios. 

To  combine  both  direct  evidence  and  indirect  evidence 
to  compute  the  overall  trust,  we  weigh  direct  trust  with 
P  =  0.8  and  indirect  trust  with  1  -  p  =  0.2,  at  which  the 
trust  bias  (i.e.,  the  discrepancy  between  actual  objective 
trust  and  measured  subjective  trust)  is  minimized  at  the 
optimal  trust  chain  length  of  4  (TC  =  4).  The  reason  direct 
trust  (through  observations)  is  weighted  more  than  indi¬ 
rect  trust  (through  recommendations)  is  that  trust  based 
on  indirect  evidence  decays  over  space  as  it  propagates 
along  the  trust  chain  especially  as  more  intermediate 
nodes  are  on  the  trust  chain.  We  control  trust  decay  over 
time  for  a  node  with  little  interaction  with  others  based 
on  Eq.  (2);  the  trust  decay  factor  p  is  set  to  1/3600  so  that 


li 

trust  decay  over  time  is  limited  by  a  ratio  of  1  -  (e_1)  in 
1  h. 

The  following  three  behavior  models  are  being  evalu¬ 
ated  to  test  their  effects  on  subjective  trust  and,  through 
Eq.  (23),  on  the  mission  success  probability: 

1.  DP:  This  behavior  model  uses  the  demand  and  pricing 
(DP)  theory  to  balance  selfishness  and  altruism  behav¬ 
ior  of  a  node  based  on  the  environmental  and  opera¬ 
tional  conditions,  as  described  in  Section  2.5; 

2.  ALT:  This  is  the  behavior  model  where  nodes  are  always 
altruistic  by  being  cooperative  (i.e.,  serving  all  requests) 
all  the  time;  and 

3.  SELF:  This  is  the  behavior  model  where  nodes  are  50% 
selfish  by  dropping  50%  of  received  packets. 

Mission  workload  is  regarded  as  one  of  most  critical 
characteristics  in  military  tactical  environments  [39,40]. 
In  this  work,  we  particularly  consider  mission  workload 
in  terms  of  packet  transmission  to  reveal  the  tradeoff  be¬ 
tween  altruism  by  cooperatively  executing  a  mission  vs. 
selfishness  by  energy  conservation  to  prolong  node  life¬ 
time,  as  we  take  both  factors  into  consideration  in  our 
composite  trust  metric.  Specifically,  we  consider  three  mis¬ 
sion  types  (Ml,  M2,  and  M3)  demanding  different  work¬ 
loads,  with  Ml  requiring  the  least  workload  while  M3 
requiring  the  most  workload  (i.e.,  Ml  <  M2  <  M3).  In  Ta¬ 
ble  2,  ,  T^2  and  T^3  are  the  service  request  inter-arrival 

times  (for  group  communication)  for  Ml,  M2,  and  M3, 
respectively.  These  will  be  used  in  place  of  Tgc  in  Eq.  (19) 
to  calculate  rate  (T_SELFISH). 

We  first  demonstrate  that  subjective  trust  obtained 
through  Eq.  (1)  evolves  over  time  and  depends  on  the 
length  of  the  trust  chain  (called  TC  for  short).  Fig.  2  shows 
the  trust  value  of  a  trustee  node  as  evaluated  by  a  trustor 
node  using  the  proposed  trust  metric  calculation  when 
the  DP  behavior  model  is  used  with  the  mission  type  being 
Ml  demanding  the  lightest  workload  among  three  mission 
types  considered.  We  aim  to  select  an  optimal  TC  to  meet 
the  acceptable  trust  accuracy  level  such  that  subjective 
trust  does  not  exceed  objective  trust  (OT)  but  is  closest 
to  OT.  When  subjective  trust  is  higher  than  OT,  it  will  re¬ 
veal  risk  vulnerability  by  possible  betrayal  of  collaborative 
parties  [31  ].  From  Fig.  2,  we  observe  that  using  TC  =  4  gives 
the  most  accurate  subjective  trust  but  reveals  little  risk 
from  overestimating  objective  trust.  This  result  can  be  ap¬ 
plied  to  a  mission  execution  situation  in  which  the  mission 
type  is  known  (Ml  as  in  Fig.  2)  to  set  the  maximum  trust 
chain  length  (the  n  parameter)  equal  to  the  optimal  TC 
length  identified  (e.g.,  4  above  in  Fig.  2)  so  as  to  provide 
the  best  trust  assessment  accuracy  without  introducing 
risk  due  to  overestimation. 

Next  we  show  the  resulting  subjective  trust  obtained 
under  three  different  selfishness  vs.  altruism  behavior 
models  (DP,  ALT,  and  SELF)  when  different  mission  types 
(Ml,  M2,  and  M3)  are  given.  Figs.  3-5  graph  the  subjective 
trust  value  obtained  vs.  time  under  various  behavior  mod¬ 
els  when  the  mission  types  are  Ml,  M2  and  M3,  respec¬ 
tively.  We  only  show  trust  values  above  ignorance  (0.5  in 
our  trust  scale  [0,1])  over  the  time  range  [0,1000]  min, 
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Trust  Chain  Length  (TC) 
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TC  =  7  TC=8  TC  =  9  ^^TC  =  10  — —  OT 


Fig.  3.  Trust  values  obtained  vs.  time  under  various  behavior  models  with 
mission  type  Ml:  one  node’s  evaluation  toward  another  node. 


Fig.  4.  Trust  values  obtained  vs.  time  under  various  behavior  models  with 
mission  type  M2:  one  node’s  evaluation  toward  another  node. 


since  trust  less  than  ignorance  is  not  meaningful  for  a  node 
to  be  regarded  as  trustworthy  for  mission  execution. 

In  Fig.  3,  we  see  that  when  time  is  sufficiently  small,  say 
t  <  250  min,  ALT  performs  the  best  among  the  three  behav¬ 
ior  models.  This  is  because  in  the  beginning,  most  nodes 
have  high  energy,  so  unselfishness  is  the  main  factor 
among  three  trust  components  to  determine  trust.  How¬ 
ever,  as  time  progresses  (i.e.,  t  ^  250  min.),  DP  performs 
the  best.  This  is  because  in  ALT  nodes  always  altruistically 
serve  requests,  so  energy  is  easily  depleted,  thus  resulting 
in  a  lower  trust  level  after  t  >  250  min.  When  t  is  very  large, 
t  ^  950  min  in  Fig.  3,  SELF  performs  the  best.  This  is  be¬ 
cause  nodes  in  SELF  have  saved  sufficient  energy  over  a 
long  period,  compared  with  those  in  other  models,  so  while 
nodes  in  DP  or  ALT  consume  most  energy,  nodes  in  SELF 


still  maintain  relatively  high  energy,  resulting  in  a  higher 
trust  level.  Note  that  in  all  three  behavior  models,  trust  is 
above  ignorance  (0.5)  over  the  entire  mission  period,  i.e., 
[0,1000]  min. 

Figs.  4  and  5  exhibit  a  similar  trend  as  Fig.  3  except  that 
the  cross-over  time  point  at  which  DP  starts  to  perform 
better  than  ALT  decreases  as  the  mission  type  goes  from 
Ml  (Fig.  3)  to  M2  (Fig.  4)  and  M3  (Fig.  5).  We  see  that 
the  cross-over  time  point  goes  from  250  min.  (Fig.  3)  to 
220  min.  (Fig.  4)  and  130  min.  (Fig.  5).  This  is  due  to  the 
fact  that  as  we  have  a  more  difficult  mission  with  a  higher 
workload  demand,  nodes  in  ALT  exhaust  energy  quickly. 
On  the  contrary,  nodes  in  DP  are  able  to  exploit  the  tradeoff 
between  selfishness  (for  their  own  welfare)  and  altruism 
(for  global  welfare)  to  save  energy  while  providing  cooper¬ 
ativeness  when  necessary.  As  a  result,  DP  catches  up  with 
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Time  (minute) 

Fig.  5.  Trust  values  obtained  vs.  time  under  various  behavior  models  with 
mission  level  M3:  one  node’s  evaluation  toward  another  node. 

ALT  after  a  shorter  time  span  as  the  mission  types  goes 
from  Ml  to  M2  and  M3.  In  particular,  we  see  from  Fig.  5 
that  when  the  mission  demands  a  high  workload  (i.e.,  un¬ 
der  M3),  SELF  with  50%  selfishness  behavior  provides  the 
lowest  trust  level  among  three  since  50%  cooperativeness 
hurts  both  energy  and  cooperativeness,  resulting  in  a  low 
trust  level  under  SELF,  compared  with  that  under  ALT  or 
DP.  The  effect  is  especially  manifested  as  the  mission  time 
increases. 

We  can  apply  the  results  obtained  here  in  two  ways:  (a) 
we  can  have  some  idea  of  the  trust  level  obtainable  under  a 
behavior  model  (e.g.,  ALT)  for  design  decision  making;  and 
(b)  we  can  decide  the  mission  execution  time  period  such 
that  trust  is  above  a  minimum  threshold  trust  level  (e.g., 
D2)  before  the  mission  execution  period  is  expired. 

In  Fig.  6,  we  show  the  probability  of  a  node’s  unselfish¬ 
ness  under  three  behavior  models  and  three  mission  types. 
We  observe  that  as  the  mission’s  workload  increases  (i.e., 
from  Ml  to  M2  and  M3),  a  node’s  unselfishness  trust  in 


mission  competion  time  (min.) 


Fig.  7.  A  node’s  trust-based  reliability  R(t )  over  time  under  Ml  under 
various  behavior  models. 

DP  is  not  significantly  different  from  the  one  in  ALT.  This 
is  because  a  node  in  DP  autonomously  adjusts  its  selfish¬ 
ness  vs.  altruism  behavior  based  on  environmental  and 
operational  conditions  including  its  own  energy  level, 
other  nodes’  selfishness  status,  and  the  mission  type.  For 
a  highly  demanding  mission  (say  M3),  nodes  in  DP  will 
tend  to  be  altruistic  to  serve  other  nodes’  requests  as  much 
as  ALT  does  for  global  welfare.  Thus,  we  do  not  see  much 
discrepancy  in  unselfishness  between  DP  and  ALT  under 
M3.  However,  for  a  less  demanding  mission  (say  Ml), 
nodes  in  DP  tend  to  be  somewhat  selfish  for  individual 
welfare  without  compromising  global  welfare.  Thus,  we 
observe  there  is  a  subtle  difference  in  unselfishness  be¬ 
tween  DP  and  ALT  under  Ml,  i.e.,  ALT’S  unselfishness  (or 
cooperativeness)  trust  is  higher  than  DP. 

Based  on  Eq.  (23),  we  test  the  effect  of  the  selfishness  vs. 
altruism  behavior  model  on  a  node’s  trust-based  reliability 
R(t)  under  three  mission  types  (Ml,  M2,  and  M3)  with 
Di  =  0.5  and  D2  =  0.85.  Figs.  7-9  graph  R(t)  vs.  time  under 
three  behavior  models  for  mission  types  Ml,  M2  and  M3, 
respectively.  Here  we  omit  the  subscript  j  in  Rj(t)  for  sim¬ 
plicity.  When  the  mission  has  a  relatively  low  degree  of  dif- 
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Fig.  6.  A  node’s  unselfishness  trust  under  various  behavior  models  and  mission  types. 
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Fig.  8.  A  node’s  trust-based  reliability  R(t )  over  time  under  M2  under 
various  behavior  models. 
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Fig.  9.  A  node’s  trust-based  reliability  R(t )  over  time  under  M3  under 
various  behavior  models. 
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ficulty  with  a  low  workload  (i.e.,  Ml  or  M2),  the  benefit  of 
DP  in  terms  of  R(t )  is  pronounced.  This  is  because  DP  can 
best  balance  selfishness  vs.  altruism  behavior  to  gain  a 
trust  level  above  D2  compared  with  the  other  two  extreme 
behavior  models  (ALT  and  SELF).  As  we  go  from  Ml  to  M2 
and  M3,  a  node  in  DP  for  global  welfare  becomes  more 
altruistic  to  serve  requests  received,  thus  mimicking  the 
behavior  of  an  altruistic  node.  Moreover,  as  the  mission 
workload  increases  (from  Ml  to  M3),  we  observe  that 
ALT  even  performs  better  than  DP  because  unlike  in  ALT, 
a  node  in  DP  is  not  100%  altruistic  and  its  unnecessary  self¬ 
ish  behavior  decreases  the  trust  level  needed  for  achieving 
M3.  Among  all,  SELF  is  the  worst  in  terms  of  R(t )  because 
50%  selfishness  behavior  achieves  little  trust  in  terms  of 
both  energy  and  cooperativeness  properties,  the  effect  of 
which  is  especially  pronounced  for  a  mission  (M3) 
demanding  a  high  workload.  Note  that  here  we  only  graph 
the  results  for  which  R(t )  is  above  0.9  as  presumably  only  a 
node  with  reliability  above  0.9  is  qualified  for  mission 
execution. 

Existing  work  in  trust/reputation  systems  [13-19]  fo¬ 
cused  on  cooperativeness  or  altruism  which  is  considered 
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Fig.  10.  A  comparative  performance  analysis  of  DP  vs.  ALT  over  all 
mission  scenarios. 


as  the  global  welfare  of  a  system.  Thus,  we  consider  ALT 
representing  existing  schemes  and  compare  it  against  our 
DP  behavior  scheme.  Fig.  10  compares  ALT  with  DP  in  the 
mission  reliability,  the  overall  trust,  and  the  unselfishness 
trust,  covering  all  mission  scenarios.  We  observe  that 
although  ALT  dominates  DP  in  altruism  (unselfishness), 
DP  outperforms  ALT  in  both  the  overall  trust  and  the  mis¬ 
sion  reliability,  especially  when  the  mission  is  less  difficult 
to  execute  (i.e.,  Ml).  This  is  because  altruism  (unselfish¬ 
ness)  does  not  guarantee  mission  success.  Excessive  altru¬ 
ism  quickly  drains  energy,  thus  shortening  a  node’s 
lifetime  that  leads  to  its  incapacitation  to  execute  the  mis¬ 
sion.  We  conclude  that  it  is  not  necessarily  always  desir¬ 
able  to  encourage  cooperative  behavior. 

Our  work  identifies  the  intelligent  altruism  vs.  selfish¬ 
ness  behavior  of  a  node  modeled  based  on  the  DP  theory 
to  maximize  the  mission  reliability  and  the  overall  trust 
over  time.  In  practice,  given  knowledge  of  a  team  composi¬ 
tion  (e.g.,  a  mobile  group  coalition  comprising  several 
nodes  following  the  DP  behavior  model)  for  accomplishing 
a  mission,  one  can  parameterize  s  and  y  for  modeling  self¬ 
ishness  vs.  altruism  behaviors.  Then,  given  knowledge  of 
node  selfishness  vs.  altruism  behaviors  for  a  mission  with 
a  certain  degree  of  difficulty  (Ml,  M2  or  M3)  as  input, 
one  can  use  the  model-based  analysis  methodology  pre¬ 
sented  in  the  paper  to  assess  trust  vs.  time,  and  ft/t)  vs. 
time,  and,  consequently,  the  mission  success  probability. 


— (e,  y)  =  (2, 0.01)  — (e,  y)  =  (4, 0.01) 

— —  (e,  v)  =  (8, 0.01)  (e,  y)  =  (2, 0.1) 

(e,y)  =  (2,0.001) 


time  (min.) 
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To  show  worthiness  and  usefulness  of  our  analysis 
methodology,  we  conduct  sensitivity  analyses  of  the  anal¬ 
ysis  results  (unselfishness  trust,  overall  trust,  and  mission 
success  reliability)  with  respect  to  &  and  y  in  Eqs.  (19) 
and  (20)  in  the  DP  behavior  model.  These  two  parameters 
control  the  change  rate  of  selfishness  and  altruism. 

Figs.  11  and  12  show  the  sensitivity  of  the  altruistic  to 
selfish  switch  rate  (called  selfish  rate  in  our  SPN  model), 
and  the  selfish  to  altruistic  switch  rate  (called  redemption 
rate  in  our  SPN  model),  respectively,  with  respect  to  (e,y), 
assuming  that  the  same  (e,y)  is  used  for  both  rates.  We  ob¬ 
serve  that  as  either  e  or  y  increases,  the  selfish  rate  (or 
redemption  rate)  also  increases.  The  impact  of  y  is  more 
significant  than  the  impact  of  8,  implying  that  y  is  a  more 
important  parameter  of  the  DP  behavior  model  than  8  in 
modeling  a  node’s  altruism  vs.  selfishness  behavior. 

Fig.  13  vividly  shows  the  resulting  unselfishness  trust, 
overall  trust  and  mission  reliability  with  s  and  y  given  as 
input.  We  again  observe  that  y  has  a  higher  impact  than 
8  on  the  unselfishness  trust  and  overall  trust.  As  expected, 
the  mission  reliability  increases  as  the  overall  trust  in¬ 
creases.  However,  we  observe  that  the  mission  reliability 
decreases  as  node  altruism  (unselfishness)  increases.  This 
verifies  our  hypothesis  that  cooperative  behavior  does 
not  always  increase  system  performance  as  high  service 
availability  can  unnecessarily  shorten  node  lifetime. 


■  Trust-based  reliability  -  R(t)  B  Avg.  trust  values  □  Avg.  unselfishness  trust 
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Fig.  14.  A  comparative  performance  analysis  of  DP  vs.  ALT  over  all 
mission  scenarios  in  the  presence  of  20%  compromised  nodes. 


Finally,  we  analyze  the  sensitivity  of  the  results  with  re¬ 
spect  to  the  presence  of  compromised  nodes  which  per¬ 
form  packet  dropping  attacks  and  stay  selfish 
continuously.  Our  intent  is  to  reveal  the  impact  of  compro¬ 
mised  nodes  on  a  node’s  self-adapting  altruistic  vs.  selfish 
behavior  adjustment  decision,  and  if  the  results  obtained 
are  resilient  to  an  increasing  compromise  node  population. 

Fig.  14  shows  the  performance  comparison  of  DP  and 
ALT  schemes  in  the  mission  reliability,  the  overall  trust, 
and  the  unselfishness  trust  in  the  presence  of  20%  compro¬ 
mised  nodes  in  the  network  for  the  beginning  2  h  of  the 
mission  period.  In  Fig.  14,  we  observe  a  similar  trend  as 
exhibited  in  Fig.  10,  i.e.,  ALT  performs  better  than  DP  in 
altruism  (unselfishness),  and  DP  outperforms  ALT  in  both 
the  overall  trust  and  the  mission  reliability.  However  un¬ 
like  Figs.  10  and  14  show  that  while  the  dominance  of  DP 
over  ALT  remains,  the  dominance  is  less  sensitive  to  the 
mission  difficulty  level  (i.e.,  from  Ml  to  M3).  The  reason 
is  that  unselfish  behavior  adjustment  is  mainly  controlled 
by  the  unselfish  neighboring  node  population  around  each 
node.  Therefore,  in  the  presence  of  more  unselfish  nodes 
around  each  node,  there  is  less  room  for  dynamic  unselfish 
behavior  adjustment. 

Fig.  15  analyzes  the  impact  of  the  %  of  compromised 
nodes  in  the  system  on  the  performance  of  the  DP  and 
ALT  schemes  for  the  beginning  2  h  of  the  mission  period. 
We  observe  that  by  means  of  self-adapting  altruistic  vs. 
selfish  behavior  control,  DP  outperforms  ALT  in  mission 
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Fig.  13.  Impact  of  (s,y)  on  unselfishness  trust,  overall  trust  and  mission  reliability. 
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Fig.  15.  A  comparative  performance  analysis  of  DP  vs.  ALT  with  %  compromised  varying  in  [0-30%]. 


reliability  over  a  wide  range  of  hostility  conditions  (with 
33%  compromised  nodes  being  the  maximum  since  a  sys¬ 
tem  subject  to  Byzantine  failure  [51  ]  will  fail  when  the  per¬ 
centage  of  compromises  nodes  exceeds  33%).  Moreover, 
the  dominance  widens  as  the  hostility  increases  from  0% 
to  30%  compromised  nodes.  This  demonstrates  the  effec¬ 
tiveness  of  self-adapting  altruistic  vs.  selfish  behavior 
adjustment  as  the  hostility  increases  in  response  to 
dynamically  changing  conditions. 


5.  Conclusions  and  future  work 

In  this  paper,  we  developed  and  analyzed  a  trust  man¬ 
agement  protocol  for  a  mission-driven  GCS  in  MANETs 
based  on  the  demand  and  pricing  (DP)  theory  to  model 
node  selfishness  or  altruism  behaviors  to  balance  individ¬ 
ual  welfare  (i.e.,  saving  energy)  vs.  global  welfare  (i.e.,  serv¬ 
ing  tasks  and  completing  the  mission).  We  developed  a 
probability  model  based  on  SPN  to  describe  the  behaviors 
of  a  large  scale  GCS  operating  under  the  proposed  trust 
management  protocol  in  MANETs.  The  results  showed  that 
the  DP  behavior  model  exploiting  the  tradeoff  between 
selfishness  vs.  altruism  outperforms  one  that  only  encour¬ 
ages  altruistic  behaviors,  or  one  that  only  encourages  self¬ 
ishness,  especially  when  the  mission  demands  a  light  to 
medium  workload.  We  attribute  the  superiority  of  the  DP 
behavior  model  to  its  ability  to  explore  the  tradeoff  be¬ 
tween  energy  saved  due  to  selfishness  vs.  quick  energy 
drainage  due  to  altruism  for  mission  execution. 

Our  proposed  behavior  model  based  on  DP  theory  can 
be  applicable  to  resource-restricted  environments  with  a 
large  number  of  nodes.  For  example,  Kumer  et  al.  [47]  ad¬ 
dressed  security  requirements  for  health  monitoring  sys¬ 
tems  using  a  large  number  of  medical  Telos-motes. 
Polastre  et  al.  [48]  presented  Telos,  a  low  power  wireless 
sensor  module  (“mote”)  where  one  goals  is  to  minimize 
power  consumption.  In  addition,  Kioumars  and  Tang  [49] 
proposed  a  wireless  sensor  developed  based  on  the  ATme- 
ga  micro-controller  and  the  XBee  protocol  for  health  mon¬ 
itoring  that  incurs  low  power  consumption.  Our  proposed 
DP  model  can  contribute  further  to  achieving  both  low 
power  consumption  and  reliable  service  provision  based 


on  the  balance  between  altruism  and  selfishness  in  re¬ 
sponse  to  network  dynamics. 

As  future  work,  we  plan  to  develop  a  more  sophisticated 
mission  model  considering  the  effect  of  mission  attributes 
such  as  the  risk,  deadline,  and  specific  workload  require¬ 
ments.  In  addition,  we  plan  to  investigate  a  hybrid  scheme 
that  allows  the  system  with  fuzzy  failure  criteria  [45]  to 
adaptively  switch  between  DP  and  ALT  trust  management 
to  maximize  the  system  reliability  for  mission  execution 
and  to  achieve  survivability.  In  this  paper  we  have  adopted 
a  random  mobility  model  for  node  movements.  This  yields 
the  “closeness”  trust  component  ineffective  in  our  trust 
management  protocol.  In  the  future,  we  plan  to  enhance 
our  analysis  with  mobility  models  or  traces  that  can  better 
describe  node  movements  of  mission  group. 
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